The question a detection system actually answers
An operator cannot see a customer's income, their relationships, their mental health or their intentions. It can see what they do in its own product, in detail, continuously. Behavioural detection is the discipline of turning that one visible stream into a defensible judgement about risk.
It is worth being precise about what such a system can and cannot produce. It cannot diagnose. It cannot establish affordability. It cannot tell you what is happening in a customer's life. What it can do is identify customers whose behaviour has changed in ways that are associated with harm, and rank them so that finite human attention goes to the right accounts first.
That is a narrow claim, and it is the claim to make. Systems that are described as identifying problem gamblers are overselling, and they are overselling in a document a regulator may later read.
Change beats level
The most common design error in this field is building a system around thresholds on levels: deposit more than X, play more than Y hours, trigger an alert.
Levels are a poor signal on their own for a simple reason. A customer who has deposited the same amount every month for three years, comfortably within their means, will breach a level threshold and generate an alert that is almost always a false positive. Meanwhile a customer whose deposits have quadrupled in a fortnight, from a low base, may never cross the threshold at all, and that is the customer whose life has changed.
Harm is usually preceded by a change in behaviour. The customer is the best baseline for the customer. A detection system built on deviation from an individual's own established pattern will catch changes that a population threshold misses, without flagging the steady customer simply for being steady. The research points the same way: a 2023 review of 15 years of studies using operator data found that variability in gambling, and above all upward trajectories in staking, spending and deposits, are among the most notable markers of higher-risk play.
This does not mean levels are useless. Absolute thresholds have a role as a backstop, particularly where a level is high enough that it demands attention whatever the history. In Britain they are also a regulatory expectation: the Commission's guidance lists amounts spent compared with other customers as an indicator, and warns that deposit or loss thresholds set too high will fail to detect some customers experiencing significant harm, so thresholds should be realistic, based on the average income available to the operator's customers. But a system in which levels do the primary work will be simultaneously noisy and blind.
The markers worth knowing
The following are the behavioural indicators that appear consistently in research, in regulatory guidance and in operator practice. Knowing them individually matters less than knowing why each one is informative. In Britain, remote operators must use at least seven categories of indicator: customer spend, patterns of spend, time spent gambling, gambling behaviour indicators, customer-led contact, use of gambling management tools and account indicators.
Chasing. Increased stakes or session length immediately following a significant loss, particularly a deposit made within minutes of a large loss. Chasing losses is central to how problem gambling is defined: both the PGSI and the DSM-IV screen ask whether the person goes back another day to try to win back money they lost, and the Commission's guidance names chasing losses among the gambling behaviour indicators operators must monitor. How it is measured matters, though. The 2023 review found that chasing defined as frequent depositing within a session receives consistent support as a risk marker, while stake increases after losses have produced mixed results, with some studies finding little evidence of them. A system should detect chasing, and it should define chasing in the form the evidence supports.
Escalation. A rising trend in deposit frequency, deposit size, stake size or session duration over weeks. The trend matters more than any single point in it.
Session length and session pattern. Long sessions, and particularly sessions that extend past the customer's own normal stopping point. A customer who habitually plays for thirty minutes and now plays for three hours has changed.
Time of day. Play at night, and specifically play in the small hours, is associated with harm: the Commission's guidance notes that a higher percentage of overnight gamblers were found to be problem gamblers than gamblers at other times of day. It is also associated with shift work, insomnia and time zones, so it is a weak marker alone and a useful one in combination.
Reduced gaps. Shortening intervals between sessions, and the disappearance of days with no play at all. A customer who used to have gambling-free days and no longer does has changed in a way that is easy to measure and easy to miss.
Deposit velocity and multiple deposits in a session. Several deposits within a single session, particularly of increasing size, indicates the customer is repeatedly deciding to add money they had not planned to add. It is also the form of chasing with the most consistent research support.
Failed and declined deposits. A declined card is a strong signal, because it often means the customer has run out of available funds and is still trying. Multiple declines followed by a successful deposit from a different instrument is stronger still. The Commission has taken action over a failure to interact with a customer who lost £98,000 over two and a half years and had 460 attempted deposits declined.
Multiple payment instruments. A growing number of cards or accounts, particularly added in quick succession, can point to exhausted funds or borrowing, and studies of operator data have found that customers who went on to self-exclude used more payment methods.
Cancelled withdrawals. A customer who requests a withdrawal and then reverses it to continue playing has explicitly changed their mind about stopping. The reverse-withdrawal facility exists to enable this, which is why Britain banned it for all online gambling from 31 October 2021, and why its use, where it is still offered, is such a clean marker. Research links reversed withdrawals to higher risk, although the review notes they can be too rare to add much to a model.
Limit behaviour. Requesting an increase to a deposit limit, particularly repeatedly, particularly soon after setting one, and particularly at the moment the existing limit binds. Cancelling a limit entirely is stronger.
Tool use and reversal. Setting a time-out and then returning immediately. Beginning a self-exclusion and abandoning it. Contacting support to have a control removed.
Erratic play patterns. Sudden switching between products, particularly from lower-frequency to higher-frequency products, and sudden changes in stake distribution within a session.
Customer contact. Complaints referencing money, requests for refunds, mentions of losses, expressions of frustration or distress in chat or email. This is the highest-value signal in the entire set because it is the customer telling you directly, and it is the one most often lost, because it sits in a support system that does not talk to the risk system. The Commission's guidance tells operators to integrate their systems so that staff have a more complete picture of the customer's activity, including records of previous interactions.
Combining markers: the part most systems get wrong
Most individual markers are weak on their own, although the Commission's guidance notes that one indicator which is particularly pronounced or unusual can itself be a strong indicator. Their value is mostly in combination, and combination is where the design decisions live.
Rule stacks count markers and act above a threshold. They are transparent, explainable to a regulator, auditable, and easy to defend. They are also blunt, they treat every marker as equally informative, and they are gamed by anyone who understands them.
Weighted scoring assigns each marker a weight and produces a continuous risk score. More expressive, still explainable, but the weights have to come from somewhere and they are frequently set by committee rather than by evidence.
Statistical and machine-learned models fit a model against an outcome. Potentially better at ranking, given a decent outcome variable, though published results are mixed, and substantially harder to explain. They also find the extremes more easily than the middle: the 2023 review found that models separate problem gamblers from non-problem gamblers reasonably well but struggle to tell low and moderate risk apart from no risk, which is where early intervention would do most good. The critical question, which is almost never asked hard enough, is what the model was trained to predict.
That last point deserves its own paragraph, because it is where the most serious failures occur. If a model is trained to predict self-exclusion, it learns to identify customers who self-exclude, which is a group that both overlaps with and differs from customers experiencing harm. In one study of more than 7,700 UK customers of a single online operator who took a six-month self-exclusion, almost a fifth had gambled for less than 24 hours and half had held their account for under seven days before excluding. If it is trained to predict complaints, it learns to find complainers. If it is trained on customers who were previously flagged by a rule stack, it learns to reproduce the rule stack including its blind spots. A model is only as good as the definition of harm it was pointed at, and most available outcome variables are proxies with known biases. Say so out loud, in the model documentation, before someone else says it for you.
Base rates, false positives and the cost of being wrong
This is the part that separates a functioning programme from an expensive one.
The population experiencing serious harm is a minority of any operator's customer base. It is not always a tiny one: the Commission's published problem gambling rates by activity, drawn from the Health Survey for England 2018, are 3.7% for online betting with a bookmaker and 8.5% for online slots, casino or bingo, and British licensees must check that their number of customer interactions is at least in line with those rates. When the base rate is low, even a test with good sensitivity and specificity produces a majority of false positives among its alerts. This is not a flaw in a particular system; it is arithmetic, and no amount of model quality removes it entirely. Take a hypothetical model that correctly flags 80% of harmed customers and correctly clears 90% of the rest, applied to 100,000 customers of whom 5% are experiencing harm. It raises 4,000 true alerts and 9,500 false ones, so roughly seven alerts in ten are false positives.
The consequences are practical. A system tuned to catch everything produces an alert volume that no human team can action, which means alerts are closed without meaningful review, which means the operator has documented, in its own systems, that it identified risk and did nothing. That record is considerably worse than having had no system at all, and it appears in enforcement casework: the Commission's 2019 to 2020 compliance and enforcement report describes an online bingo operator whose customer generated 56 automated safer gambling pop-ups and 13 in-play messages while continuing to play without restriction or any more meaningful interaction.
The remedy is not to tune the system down until the volume is comfortable. It is to build a response that matches the signal strength.
Tier the response to the confidence. A weak signal warrants an automated, low-cost, low-friction action: a targeted message, a prompt to review limits, a suppression of marketing. A strong or repeated signal warrants a human contact. A very strong signal warrants immediate restriction pending contact. British rules require much the same: licensees must tailor their action to the number and level of indicators of harm, act on strong indicators through automated processes that are manually reviewed in each customer's case, and stop marketing and new bonus offers to customers showing strong indicators.
Size the human capacity to the strong-signal volume, then set the threshold to that capacity. Doing it the other way round guarantees a backlog.
Measure the closure quality, not the closure rate. A team closing every alert within the service level is not evidence of anything.
The cost of a false negative is a customer harmed and, in a regulated market, a penalty. The cost of a false positive is a contacted customer who was fine, some friction, and possibly a complaint. Those costs are not symmetric, and the tuning should reflect that they are not, but a programme that ignores false-positive cost entirely will drown and stop working.
Identity resolution: the silent failure
Every marker in this lesson is computed per account. If one person holds several accounts, each one shows a fraction of the behaviour and none of them trips anything.
This is a bigger problem than most operators acknowledge. Multi-accounting within a single brand, accounts across brands in the same group, and accounts across the market all fragment the picture. Group-level identity resolution is achievable and is not always done, because the brands are operated separately and the data is not joined. The Commission's enforcement report records a customer with 11 accounts who was allowed to deposit more than £494,000 in 17 months, and asks operators whether they track customers across platforms and do enough to spot multiple accounts. Market-level resolution requires a central register or a data-sharing scheme between operators, which is harder still, legally as well as technically. In Britain, where the Commission says online gamblers hold an average of three accounts, it challenged the industry in 2020 to develop a cross-operator single customer view, and the Information Commissioner's Office found in 2021 that such data sharing may be lawful under UK GDPR.
An operator that has not resolved identity across its own brands has a detection system reporting on fragments and should not present its outputs as a view of the customer.
Evaluating whether any of it works
Detection is a means. The end is a change in the customer's behaviour and, ultimately, in their outcome. Most programmes measure the means.
Weak measures. Alerts generated. Interactions completed. Time to closure. Tools promoted. These describe activity, not effect, and an operator reporting them as evidence of effectiveness is reporting that it was busy.
Better measures. Change in the flagged behaviour after the intervention, measured over a meaningful window. Rate of recurrence. Proportion of flagged customers who subsequently set or lowered a limit, or self-excluded, and what happened next. Proportion who escalated despite contact. In Britain this is a requirement rather than good practice: licensees must evaluate the impact of individual interactions and the effectiveness of their overall approach, and the Commission's guidance says reduction of indicators of harm following action is the key measure.
Best, and hardest. A comparison against a counterfactual. Where an operator can construct a defensible comparison group, whether through a staged rollout, a randomised assignment of intervention type, or a natural experiment created by a system change, it can make a genuine causal claim about what its interventions do. Published evidence of this kind is scarce: the 2023 review found that studies of responsible gambling tools generally use before-and-after designs, only sometimes with a comparison group, and called for more work on long-term impact. The ethical constraints on withholding an intervention are real and must be respected, and the operators that navigate them have evidence nobody can argue with.
The honest summary of the field is that detection has improved considerably and evaluation has not kept pace. An operator that can demonstrate, with evidence, that its interventions change behaviour is in a small minority, and that is where the competitive and regulatory advantage now sits.